Advanced Settings

Allow Post-Scan Editing (allow_post_scan_editing)

Allows a user to make edits to scan results after the scan is complete.

no

yes or no

no

yes or no

A text banner that appears after you attempt to log in to Tenable Nessus.

Note: The banner only appears the first time you log in on a new browser or computer.

Maximum Concurrent Web Users (global.max_web_users)

Maximum web users who can connect simultaneously.

Integers.

If set to 0, there is no limit.

IPv4 address to listen for incoming connections. If set to 127.0.0.1, this restricts access to local connections only.

When enabled, changes user interface color theme to dark mode.

Note: The UI Theme setting may not function properly if you have SELinux enabled.

Automatically activates the plugins that are depended on by other plugins. The setting does not enable plugins that are depended on by scan template settings.

If disabled, not all plugins may run despite being selected in a scan policy.

A colon-delimited list of CGI paths to use for web server scans.

/cgi-bin:/scripts

The maximum size, in KB, of plugin output that Tenable Nessus includes in the exported scan results with the .nessus format. If the output exceeds the maximum size, Tenable Nessus truncates the output in the report.

Integers.

If set to 0, there is no limit.

Location of the Tenable Nessus rules file (nessusd.rules).

The following are the defaults for each operating system:

Linux:

/opt/nessus/etc/nessus/nessusd.rules

macOS:

/Library/Nessus/run/var/nessus/conf/nessusd.rules

Windows:

C:\ProgramData\Tenable\Nessus\nessus\conf\nessusd.rules

default, all, a range of ports, a comma-separated list of ports and/or port ranges.

Specify UDP and TCP ports by prefixing each range by T: or U:.

When enabled, Tenable Nessus uses safe checks, which use banner grabbing rather than active testing for a vulnerability.

In Tenable Nessus scanners and Tenable Nessus Professional, you can choose whether Tenable Nessus calculates the severity of vulnerabilities using CVSSv2 or CVSSv3 scores (when available) by configuring your default severity base setting. In Tenable Nessus scanners and Tenable Nessus Professional, you can choose whether Tenable Nessus calculates the severity of vulnerabilities using CVSSv2, CVSSv3, or CVSSv4 scores (when available) by configuring your default severity base setting.

When you change the default severity base, the change applies to all existing scans that are configured with the default severity base. Future scans also use the default severity base.

For more information about CVSS scores and severity ranges, see CVSS Scores vs. VPR.

On preexisting upgraded instance: cvss_v2

Location of nessusd.dump, a log file for debugging output if generated.

The following are the defaults for each operating system:

Linux:

/opt/nessus/var/nessus/logs/nessusd.dump

macOS:

/Library/Nessus/run/var/nessus/logs/nessusd.dump

Windows:

C:\ProgramData\Tenable\Nessus\nessus\logs\nessusd.dump

Nessus log directory for your operating system

The type of NASL engine output in nessusd.dump.

Determines whether Tenable Nessus rotates dump files based on maximum rotation size or rotation time.

time — Tenable Nessus rotates dump files based on time, as specified in dumpfile_rotation_time.

The logging level of the backend.log log file, as indicated by a set of log tags that determine what information to include in the log.

If you manually edited log.json to set a custom set of log tags for backend.log, this setting overwrites that content.

For more information, see Manage Logs.

• normal — sets log tags to log, info, warn, error, trace
• debug — sets log tags to log, info, warn, error, trace, debug
• verbose — sets log tags tolog, info, warn, error, trace, debug, verbose

Location where Tenable Nessus stores its scanner log file.

The following are the defaults for each operating system:

Linux:

/opt/nessus/var/nessus/logs/nessusd.messages

macOS:

/Library/Nessus/run/var/nessus/logs/nessusd.messages

Windows:

C:\ProgramData\Tenable\Nessus\nessus\logs\nessusd.messages

Tenable Nessus — 100

Tenable Nessus Agent — 2

Integers 1-1000

Tenable Nessus —512

Tenable Nessus Agent — 10

Integers 1-2048

Determines whether Tenable Nessus rotates messages log files based on maximum rotation size or rotation time.

size — Tenable Nessus rotates log files based on size, as specified in logfile_max_size.

time — Tenable Nessus rotates log files based on time, as specified in logfile_rotation_time.

0 (off), 0x3f (full data except plugin metrics), 0x7f (full data including plugin metrics)

Note: Including plugin metrics greatly increases the size of the log file. Tenable Nessus does not automatically clean up log files.

Control how database updates are synchronized to disk.

NORMAL is faster, with some risk of data loss during unexpected system shutdowns (for example, during a power outage or crash).

FULL is safer, with some performance cost.

Maximum number of hosts that Tenable Nessus can scan simultaneously across all scans.

Varies depending on hardware

50 for desktop operating systems (for example, Windows 10).

50000 for other operating systems (for example, Windows Server 2016).

Integers

Maximum number of simultaneous plugins that can run concurrently on each host.

Integers

Integers.

If set to 0, defaults to 100.

Integers 0-1000

If set to 0, there is no limit.

Maximum number of simultaneous plugins that can run concurrently on a single scan engine.

The number of simultaneous connection attempts before the web server does not allow further connections.

Maximum number of simultaneous TCP sessions for a single host.

This TCP throttling option also controls the number of packets per second the SYN scanner sends, which is 10 times the number of TCP sessions. For example, if you set this option to 15, the SYN scanner sends 150 packets per second at most.

Integers.

If set to 0, there is no limit.

Integers 0-2000.

If set to 0, there is no limit.

Determines the type of check that Tenable Nessus performs before a plugin runs.

If you set this setting to open_ports, then Tenable Nessus checks that required ports are open; if they are not, the plugin does not run.

If you set this setting to required_keys, then Tenable Nessus performs the open port check, and also checks that required keys (KB entries) exist, ignoring the excluded key check.

Limits the number of remediations that Tenable Nessus generates and shows in a scan result.

Read timeout for the sockets of the tests.

Always validate SSL server certificates, even during initial remote link (requires manager to use a trusted root CA).

Integers 0-2000.

If set to 0, there is no limit.

Cipher list to use for Tenable Nessus backend connections. You can use a preconfigured list of cipher strings, or enter a custom cipher list or cipher strings.

Note: This setting only sets ciphers for TLS 1.2.

compatible

• legacy - A list of ciphers that can integrate with older and insecure browsers and APIs.

• compatible - A list of secure ciphers that is compatible with all browsers, including Internet Explorer 11. May not include all the latest ciphers.

• modern - A list of the latest and most secure ciphers. May not be compatible with older browsers, such as Internet Explorer 11.

• custom - A custom OpenSSL cipher list. For more information on valid cipher list formats, see the OpenSSL documentation.

• niap - A list of ciphers that conforms to NIAP standards.

  ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES256-GCM-SHA384

Minimum supported version of TLS.

• compat - TLS v1.0+
• ssl_3_0 - SSL v3+
• tls_1_1 - TLS v1.1+
• tls_1_2 - TLS v1.2+
• niap - TLS v1.2

Controls whether agents are automatically unlinked after they have been inactive for the duration of time set for agent_auto_unlink_threshold.

The number of days after which inactive agents are automatically unlinked if agent_auto_unlink is set to yes.

Note: This value must be less than the agent_auto_delete_threshold.

Integers.

If set to 0, this defaults to 100.

When enabled, new Tenable Nessus Agent software updates are automatically downloaded.

Controls whether or not agent scan result audit trail data is included in the main agent database. Excluding audit trail data can significantly improve agent result processing performance.

If this setting is set to false, the Audit Trail Verbosity setting in an individual scan or policy defaults to No audit trail.

Includes the agent scan result KB data in the main agent database. Excluding KB data can significantly improve agent result processing performance.

If this setting is set to false, the Include the KB setting in an individual scan or policy defaults to Exclude KB.

Sets the journaling mode to use when processing agent results. Depending on the environment, this can somewhat improve processing performance, but also introduces a small risk of a corrupted scan result in the event of a crash. For more details, refer to the sqlite3 documentation.

MEMORY

TRUNCATE

DELETE

Sets the filesystem sync mode to use when processing agent results. Turning this off will significantly improve processing performance, but also introduces a small risk of a corrupted scan result in the event of a crash. For more details, refer to the sqlite3 documentation.

OFF

NORMAL

FULL

The number of days that an agent remains blocked from relinking to a cluster node.

For example, Tenable Nessus blocks an agent if it tries to link with a UUID that matches an existing agent in a cluster.

Note: Tenable Nessus blocks an agent after Tenable Nessus deletes or removes the agent due to inactivity. However, Tenable Nessus places the agent back in good standing if an administrator manually unlinks and relinks the agent.

Integers > 0

The global default maximum number of agents allowed per cluster node.

If you set an individual maximum for a child node, that setting overrides this setting.

Integers > 0

Automatically updates plugins. If you enable this setting and register Tenable Nessus, Tenable Nessus automatically gets the newest plugins from Tenable when they are available. If your scanner is on an isolated network that is not able to reach the internet, disable this setting.

Note: This setting does not work for Tenable Nessus scanners that you connected to Tenable Vulnerability Management. Scanners linked to Tenable Vulnerability Management automatically receive updates from cloud.tenable.com. For more information, see the knowledge base article.

Automatically download and apply Tenable Nessus updates.

Note: This setting does not work for Tenable Nessus scanners that you connected to Tenable Vulnerability Management. Scanners linked to Tenable Vulnerability Management automatically receive updates from cloud.tenable.com. For more information, see the knowledge base article.

Tenable Nessus automatically creates a backup file every 24 hours. Use this setting to determine how many days Tenable Nessus keeps the backup files before discarding them. For example, if you keep this setting at the default 30 days, Tenable Nessus stores daily backup files for the past 30 days.

For more information about Tenable Nessus backup files, see Back Up Tenable Nessus.

Determines Java heap size (the system memory used to store objects instantiated by applications running on the Java virtual machine) Tenable Nessus uses when exporting PDF reports.

Location of the configuration file that contains the engine preference settings.

The following are the defaults for each operating system:

Linux:

/opt/nessus/etc/nessus/nessusd.db

macOS:

/Library/Nessus/run/etc/nessus/conf/nessusd.db

Windows:

C:\ProgramData\Tenable\Nessus\conf\nessusd.db

The number of days after which Tenable Nessus removes orphaned Tenable Security Center scans. For example, an orphaned scan could be a scan executed via Tenable Security Center that was not properly removed.

If set to 0, Tenable Nessus does not perform a cleanup.

Note: This setting only applies to network scans launched from Tenable Security Center. It does not apply to agent or web application scans.

When enabled, Tenable Nessus periodically and securely sends non-confidential product usage data to Tenable.

Usage statistics include, but are not limited to, data about your visited pages within the Tenable Nessus interface, your used reports and dashboards, your Tenable Nessus license, and your configured features. Tenable uses the data to improve your user experience in future Tenable Nessus releases. You can disable this option at any time to stop sharing usage statistics with Tenable.

The number of days after which Tenable Nessus deletes the scan history and data for completed scans permanently.

Note: This setting affects any scanner, agent, and web application scans launched from Tenable Security Center.

0 or integers larger than or equal to 3.

If set to 0, Tenable Nessus retains the history.

Adds a classification banner to the top and bottom of the Tenable Nessus user interface, and turns on last successful and failed login notification.

When disabled, to avoid overwhelming a host, Tenable Vulnerability Management prevents a single scanner from simultaneously scanning multiple targets that resolve to a single IP address. Instead, Tenable Vulnerability Management scanners serialize attempts to scan the IP address, whether it appears more than once in the same scan task or in multiple scan tasks on that scanner. Scans may take longer to complete.

When enabled, a Tenable Vulnerability Management scanner can simultaneously scan multiple targets that resolve to a single IP address within a single scan task or across multiple scan tasks. Scans complete more quickly, but scan targets could potentially become overwhelmed, causing timeouts and incomplete results.

Supports merging plugin results for plugins that generate multiple findings with the same host, port, and protocol. Tenable recommends enabling this option for scanners linked to Tenable Security Center.

A text banner shows that appears after you attempt to log in to Tenable Nessus. The banner only appears the first time you log in on a new browser or computer.

timeout.<plugin ID>